CVE-2023-25752

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 111
Mozilla	Firefox ESR	>= unspecified, < 102.9
Mozilla	Thunderbird	>= unspecified, < 102.9

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1811627Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-09/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-11/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1811627Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-09/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-11/Vendor Advisory

Timeline

Published: Jun 2, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-257536.5There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us CVE-2023-257549.8Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0 CVE-2023-257557.8Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory CVE-2023-257568.0Out-of-bounds read in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pri CVE-2023-257577.2Improper access control in some Intel(R) Unison(TM) software before version 10.12 may allow a privileged user to potentially enable escalati CVE-2023-257584.2Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The ma CVE-2023-257595.4OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run CVE-2023-25764.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 befo CVE-2023-257608.8Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords vi CVE-2023-257615.4Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored CVE-2023-257625.4Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Gener CVE-2023-257635.4Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cr